Strac is a data security platform that finds sensitive data across SaaS applications, cloud stores, endpoints and AI tools, and stops it leaking. It is for security and compliance teams who need to control PII, PHI, payment data, source code and intellectual property as it moves through Slack, email, browsers, file shares and, increasingly, AI assistants and agents.
The problem is that sensitive data now moves faster and through more channels than traditional data protection was designed for, and each new SaaS app or AI tool adds another route out. Strac puts those routes under one set of rules.
At A Glance
| Vendor | Strac |
|---|---|
| Category | Data security (DSPM and DLP) |
| Deployment | SaaS and cloud connectors, endpoint and browser DLP, self-hosted on-premises options |
| Agentic AI | MCP DLP, generative AI DLP for ChatGPT, Claude, Gemini and Copilot |
| Customers | UiPath, Zeta, Paymentology, ThredUp, HoneyBook |
| Founded | 2021 |
| Market classification | Data Security |
What Strac Does
Sensitive data no longer stays in a database. It gets pasted into chat, attached to tickets, synced to shared drives and now sent to AI models through prompts and tool calls. Strac’s approach is to find that data first, wherever it sits, and then enforce the same policy on it at rest, in motion and on its way into an AI model. Fixes are applied automatically in the app where the data lives, so users keep working while the risky copy is redacted or its sharing removed. The platform supports compliance with PCI, HIPAA, SOC 2, ISO 27001, CCPA and GDPR.
Products
Data Discovery And Classification
Discovery is the starting point for teams that do not yet know where their sensitive data lives. Strac scans new content in real time and runs deep historical scans over legacy data in SaaS, cloud and on-premises stores, detecting regulated and confidential data, including in files including pdf, docx, png, jpeg, doc and xls.
DSPM
DSPM turns findings into fixes for SaaS and cloud data. It revokes public or external sharing, applies classification labels and covers data stores in AWS, Azure, Snowflake, SQL and Oracle.
DLP
Strac’s DLP family protects data in motion: SaaS DLP, Enterprise DLP, Email Security, browser DLP and Endpoint DLP for Mac, Windows and Linux. Remediation ranges from redaction and masking to blocking, alerting, deletion and labelling. Endpoint Data Lineage tracks where corporate files came from, which helps investigate how a file reached a personal device.
Generative AI DLP And MCP DLP
These products are for organisations that want staff and agents to use AI without sending regulated data to a model. ChatGPT, Copilot, Gemini and Claude each have their own DLP connector, so users can be warned, nudged or blocked, and an integration with the Claude Compliance API covers enterprise Claude workspaces. MCP DLP intercepts MCP tool responses and redacts sensitive content inline before the model sees it. It also logs MCP tool calls by agent and data source, discovers shadow MCP servers and detects prompt injection patterns in tool responses.
Developer APIs And Document Vault
Engineering teams can build Strac into their own products. Detection and redaction APIs handle text and documents, tokenisation stores sensitive values in a vault, and the Document Vault keeps files under end to end encryption.
How It Works
Strac connects to each environment in the way that suits it.
| Component | What it does |
|---|---|
| No-code integrations | Customers configure Strac in a SaaS or cloud app (AWS, Azure, GCP) and it detects and redacts sensitive data automatically. Google Sheets anonymisation uses domain wide delegation. |
| Endpoint and browser | Agents run on Mac, Windows and Linux endpoints and in Chrome, Edge, Firefox and Safari. ChatGPT coverage is delivered as a Chrome extension. |
| On-premises | DLP On Premise and Data Discovery On Premise are self-hosted and scan NAS, SMB and file servers. |
| APIs and vault | Developer APIs authenticate with an API key in the X-Api-Key header over HTTPS. Tokens reference values held in the vault, and detokenisation is limited to server to server connections. |
| UX components | Each widget runs in an iframe hosted on Strac’s domain, keeping sensitive data isolated from the customer’s page. |
Integrations
| Area | Integrations |
|---|---|
| SaaS | Slack, Gmail, Office 365, Google Drive, Salesforce, Jira, Confluence, Box, OneDrive, Dropbox, SharePoint, Zendesk, Intercom, HubSpot, Notion, Microsoft Teams, Zoom, GitHub, ServiceNow, Asana, Linear |
| Cloud and data | AWS S3, CloudWatch, DynamoDB, Azure Blob Storage, Snowflake, Postgres, SQL, Oracle, logs |
| Generative AI | ChatGPT, Copilot, Gemini, Claude |
Company Background
| Headquarters | Bellevue, Washington, United States. |
|---|---|
| Leadership | Aatish Mandelecha, founder. |
| Funding | A reported $3.5 million round in 2022, led by FUSE with Y Combinator, Liquid 2 Ventures, Wayfinder Ventures, Rogue Capital and Unshackled. |
Note: This overview is compiled from Strac’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.